Could The Plant Run By Hand After A Cyberattack? 40% Don’t Know, SANS Finds

Estimated reading time: 7 minutes

SANS surveyed 696 industrial security professionals. Only 15% say their sites could run by hand for more than 48 hours. Another 40% don’t know. In a separate survey, every security executive who answered expects production to continue.

A third of industrial organizations reported a cyber incident in their control systems this year. SANS Institute published its 2026 State of ICS/OT Security Survey on Nov. 10.

ICS and OT are the control systems that run plants, pipelines, and power grids. This year’s survey asks what happens when an attack gets through. Can the site stay safe and keep operating?

SANS sells cybersecurity training and certification. Seven vendors sponsored the survey: Acronis, Claroty, Corsha, Dispel, Dragos, Fortinet and OPSWAT. Several sell tools that monitor industrial networks. Jason Christopher, a SANS instructor, wrote the report.

OT Security Incidents Rose And Hit Harder

Thirty-four percent of respondents confirmed an incident in the past 12 months. The share was 22% a year earlier, SANS said. It calls that the largest single-year jump since the survey began in 2017.

• 72% of reported incidents came with facility or system downtime, SANS says.
• 31% involved ransomware. Compromise of shared IT and OT credentials tied it at 31%.
• 24% involved an exploited firewall or edge device.
• 13% affected safety. That share nearly doubled.

Among respondents with an incident, 34% reported financial loss. Theft of intellectual property rose to 31% from 6%. The report does not explain that jump.

Ransomware took the longest to clear. In 31% of ransomware incidents, the facility or system was down for eight to 30 days. In 11%, it was down for one to three months.

Detection slowed for the first time in the survey’s history. Respondents found 41% of incidents within 24 hours. More than half met that mark in each of the past two years.

Few of these losses appear to reach an insurer. Claroty, one of the sponsors, ran its own survey this year. Fewer than one in four respondents listed an insurance claim among the results of an OT incident, CINI reported.

Edge devices are a frequent entry point. Lumen told CINI that the FortiBleed campaign targeted at least 13,000 Fortinet devices.

Can The Plant Run By Hand?

Manual mode is the fallback when a site loses its central control system. Operators run the process by hand.

SANS asked whether critical operations could run that way for more than 48 hours.

• 15% said they were fully capable.
• 34% said partially capable.
• 40% did not know.

“An untested assumption is not a capability,” Christopher wrote.

SANS also asked how fast the most critical facility could come back after an attack. The scenario required manual mode or a full rebuild of control systems. Twenty-seven percent believe they could restore it within a day. Another 25% said two to seven days. Thirteen percent did not know.

Two habits went with faster estimates. One is testing resilience plans at least once a year. The other is building control systems into business continuity and disaster recovery plans. Among organizations that did both, 46% expect to recover within a day.

Those are estimates. They are not measured recoveries. Cohesity found that real recoveries take about twice as long as planned, CINI reported.

Both habits are uncommon. Sixteen percent have fully integrated control systems into continuity planning. Twenty-nine percent test at least annually. Sixteen percent have never formally tested.

OT Security Leaders Are More Confident Than Practitioners

SANS sent a separate survey to senior executives this year. Most were CISOs, CSOs, and security vice presidents.

It asked how operations would fare if enterprise IT were fully compromised. Every leader who answered expects production to continue. Thirty-eight percent expect it to continue indefinitely on isolated control systems. Sixty-two percent expect it to continue for a time on manual controls. None expects a halt.

SANS sets that beside the practitioners’ answers on manual mode. Leaders were more optimistic than the people they lead, the report says.

The confidence does not rest on testing. Fourteen percent of leaders report routine technical validation, such as threat hunting in control systems. Leaders also listed who must attend incident drills. Enterprise IT security is required in 83% of programs. Plant managers and frontline operators are required in 58%.

Two cautions apply. The two surveys asked different questions. SANS does not say how many leaders responded. It calls the sample smaller.

One Vendor, A Few People

SANS posed a worst case. The organization’s main automation vendor disappears tomorrow. The cause could be sanctions, bankruptcy, or a catastrophic breach.

• 10% could operate indefinitely.
• 58% would shut down or be unable to operate within a year.
• 13% did not know.

Switching vendors is slow. Forty-two percent said a move would take one to three years. Twenty-eight percent said three to five. Six percent said it would be impossible without rebuilding the facility.

Twenty percent have a fully functional program for supply chain cyber risk. For insurers, one vendor behind many plants is an accumulation question.

People are a dependency too. Sixty-eight percent said losing one or two key individuals would delay response or put it at severe risk. Five percent reported no such reliance.

What Detection Tools Showed

Dedicated OT detection platforms found 38% of reported incidents. That was more than any other method. IT perimeter tools found 31%. Human operators noticed 20%.

Thirteen percent of respondents report full visibility across IT and OT. Budget was the most cited barrier to more, at 43%.

Honeywell’s benchmark tied visibility to shorter outages. Among respondents with an incident, 42% with stronger asset visibility reported downtime of six hours or less. The figure was 25% for weaker visibility, CINI reported. Honeywell sells industrial automation and security products.

SANS says organizations with full visibility saw less perimeter exploitation and less unauthorized access. Its table supports that. The same table shows that the group reported more ransomware, at 41%. It also reported more safety events, at 31%.

The report does not address those higher figures. It does raise one possibility elsewhere. Sites without monitoring may not see their incidents at all.

Several of the survey’s sponsors sell detection platforms.

What The Survey Does Not Show

Respondents come from the SANS community. That group skews toward organizations already investing in security, SANS says. It reads its own benchmarks as a floor.

The answers are self-reported. The recovery and vendor figures describe what respondents expect. Nobody measured them.

Energy supplied 23% of respondents. Critical manufacturing supplied 10%.

The report does not mention insurance. It ends with a 12-question self-assessment. The questions cover plan testing, manual operation, visibility, and vendor dependence.

FAQ – OT Security

What is OT security?

The protection of operational technology and industrial control systems. These run plants, pipelines, water systems, and power grids.

How many industrial organizations had an OT security incident?

Thirty-four percent of respondents to the SANS 2026 survey confirmed one in the past 12 months. SANS put the prior year at 22%.

How often do OT security incidents cause downtime?

SANS says 72% of reported incidents came with facility or system downtime.

Can plants run manually after a cyberattack?

Fifteen percent said they could sustain manual operations past 48 hours. Forty percent did not know.

How dependent are plants on automation vendors?

If their main vendor disappeared, 58% would shut down or be unable to operate within a year. Ten percent could run indefinitely.

Who sponsored the SANS survey?

Acronis, Claroty, Corsha, Dispel, Dragos, Fortinet and OPSWAT.

Related Cyber Insurance Posts

• An AI Agent Can Pass Every Check And Still Make A Payment Nobody Wanted, Shufti Says
• AI Identity Risk Surges in 2026 as Executives Admit Low Preparedness(Opens in a new browser tab)
• Don’t Tip Your Hand to Ransomware Crooks (Opens in a new browser tab)
• Lloyd’s Syndicate 1176 and Chaucer Launch Cyber Insurance Policy for Nuclear Power Plants(Opens in a new browser tab)
• Industrial Sector Hit Hard by Ransomware Rampage(Opens in a new browser tab)